+ j]Rt^RIt^RIHt^RIHtHt^RIHt^RI H t H t H t H t Ht^RIHt^RIHt^RIHt^R IHtR t!R R ] 4t!R R]4tR#)z[ Tests for L{twisted.cred._digest} and the associated bits in L{twisted.cred.credentials}. N)hexlify)md5sha1) verifyObject)DigestCredentialFactoryIUsernameDigestHashcalcHA1calcHA2 calcResponse) LoginFailed) IPv4Address) networkString)TestCasecJ\P!V4P4#)N)base64 b64encodestrip)ss&C/usr/lib/python3/dist-packages/twisted/cred/test/test_digestauth.pyrrs   A  $ $ &&cBaa]tRt^!toRtV3RltRtRtRtVt V;t #)FakeDigestCredentialFactoryzP A Fake Digest Credential Factory that generates a predictable nonce and opaque c6<\SV`!V/VBRVnR#)0N)super__init__ privateKey)selfargskwargs __class__s&*,rr$FakeDigestCredentialFactory.__init__'s $)&)rc R#)z Generate a static nonce s178288758716122392881254770685rs&r_generateNonce*FakeDigestCredentialFactory._generateNonce+s1rc ^#)z Return a stable time r#r$s&r_getTime$FakeDigestCredentialFactory._getTime1sr)r) __name__ __module__ __qualname____firstlineno____doc__rr%r(__static_attributes____classdictcell__ __classcell__)r __classdict__s@@rrr!s 1 rrc2a]tRt^8toRtRtR]3RltRtRt R]3Rlt R]3Rlt R t R t R tR tR]3R ltRtRtR]3RltRtRtR*RltRtR*RltRtRtRtRtRtRtRtRt Rt!Rt"R t#R!t$R"t%R#t&R$t'R%t(R&t)R't*R(t+Vt,R)#)+DigestAuthTestsz L{TestCase} mixin class which defines a number of tests for L{DigestCredentialFactory}. Because this mixin defines C{setUp}, it must be inherited before L{TestCase}. c RVnRVnRVnRVnRVnRVnRVn\RR R 4VnR Vn \VPVP4Vn R #) z. Create a DigestCredentialFactory for testing foobarsbazquuxs test realmmd5s 29fc54aa1641c6fa0e151419361c8f23auths/write/TCPz10.2.3.4iuGETN) usernamepasswordrealm algorithmcnonceqopurir clientAddressmethodrcredentialFactoryr$s&rsetUpDigestAuthTests.setUp?sd" " " 9 ( EB !8!Trr7c :Rp\WPVPVPW0P4pRP VPVPVP34p\ V!V4P44pVPWF4R#)zv L{calcHA1} accepts the C{'md5'} algorithm and returns an MD5 hash of its parameters, excluding the nonce and cnonce. s abc123xyz:N) rr;r=r<r?joinrdigest assertEqual)r _algorithm_hashnoncehashA1a1expecteds&&& rtest_MD5HashA1DigestAuthTests.test_MD5HashA1Nst   tzz4==% YY tzz4==A B59++-. *rc Rp\RVPVPVPWP4pVPR,VP,R,VP,p\ \ V4P44pVR,V,R,VP,p\ \ V4P44pVPW%4R#)z{ L{calcHA1} accepts the C{'md5-sess'} algorithm and returns an MD5 hash of its parameters, including the nonce and cnonce. s xyz321abcmd5-sessrHN) rr;r=r<r?rrrJrK)rrNrOrPha1rQs& rtest_MD5SessionHashA1%DigestAuthTests.test_MD5SessionHashA1[s   DMM5++ ]]T !DJJ . 5 Ec"gnn&' 4Z% $ & 43r7>>+, *rc 2VPR\4R#)zu L{calcHA1} accepts the C{'sha'} algorithm and returns a SHA hash of its parameters, excluding the nonce and cnonce. shaN)rRrr$s&rtest_SHAHashA1DigestAuthTests.test_SHAHashA1js FD)rc Rp\WVPRR4pVR,VP,p\V!V4P44pVP WF4R#)z L{calcHA2} accepts the C{'md5'} algorithm and returns an MD5 hash of its arguments, excluding the entity hash for QOP other than C{'auth-int'}. r:r8NrHr rArrJrK)rrLrMrChashA2a2rQs&&& rtest_MD5HashA2Auth"DigestAuthTests.test_MD5HashA2AuthqsT TXXwE d]TXX %59++-. *rc RpRp\WVPRV4pVR,VP,R,V,p\V!V4P44pVP WW4R#)z L{calcHA2} accepts the C{'md5'} algorithm and returns an MD5 hash of its arguments, including the entity hash for QOP of C{'auth-int'}. r:s foobarbazsauth-intrHNr^)rrLrMrChentityr_r`rQs&&& rtest_MD5HashA2AuthInt%DigestAuthTests.test_MD5HashA2AuthInt}sc TXX{GL d]TXX % ,w 659++-. *rc (VPR4R#)z L{calcHA2} accepts the C{'md5-sess'} algorithm and QOP of C{'auth'} and returns the same value as it does for the C{'md5'} algorithm. rUN)rar$s&rtest_MD5SessHashA2Auth&DigestAuthTests.test_MD5SessHashA2Auths  ,rc (VPR4R#)z L{calcHA2} accepts the C{'md5-sess'} algorithm and QOP of C{'auth-int'} and returns the same value as it does for the C{'md5'} algorithm. rUN)rer$s&rtest_MD5SessHashA2AuthInt)DigestAuthTests.test_MD5SessHashA2AuthInts "";/rc 2VPR\4R#)z L{calcHA2} accepts the C{'sha'} algorithm and returns a SHA hash of its arguments, excluding the entity hash for QOP other than C{'auth-int'}. rZN)rarr$s&rtest_SHAHashA2Auth"DigestAuthTests.test_SHAHashA2Auths -rc 2VPR\4R#)z L{calcHA2} accepts the C{'sha'} algorithm and returns a SHA hash of its arguments, including the entity hash for QOP of C{'auth-int'}. rZN)rerr$s&rtest_SHAHashA2AuthInt%DigestAuthTests.test_SHAHashA2AuthInts ""640rc  RpRpRpVR,V,R,V,p\V!V4P44p\W4WRRR4pVPWx4R#)z L{calcResponse} accepts the C{'md5'} algorithm and returns an MD5 hash of its parameters, excluding the nonce count, client nonce, and QoP value if the nonce count and client nonce are L{None} abc123789xyzlmnopqrHNrrJr rK) rrLrMrOr_rNresponserQrJs &&& rtest_MD5HashResponse$DigestAuthTests.test_MD5HashResponsesb D=5(4/&85?1134fjtTR *rc (VPR4R#)z L{calcResponse} accepts the C{'md5-sess'} algorithm and returns an MD5 hash of its parameters, excluding the nonce count, client nonce, and QoP value if the nonce count and client nonce are L{None} rUN)ryr$s&rtest_MD5SessionHashResponse+DigestAuthTests.test_MD5SessionHashResponses !!+.rc 2VPR\4R#)z L{calcResponse} accepts the C{'sha'} algorithm and returns a SHA hash of its parameters, excluding the nonce count, client nonce, and QoP value if the nonce count and client nonce are L{None} rZN)ryrr$s&rtest_SHAHashResponse$DigestAuthTests.test_SHAHashResponses !!&$/rc  *RpRpRpRpRpRpVR,V,R,V,R,V,R,V,R,V,p \V!V 4P44p \W4WWgV4p VPW4R#) z L{calcResponse} accepts the C{'md5'} algorithm and returns an MD5 hash of its parameters, including the nonce count, client nonce, and QoP value if they are specified. rtrurvs00000004s abcxyz123r8rHNrw) rrLrMrOr_rN nonceCount clientNoncer@rxrQrJs &&& rtest_MD5HashResponseExtra)DigestAuthTests.test_MD5HashResponseExtras  "                  5?1134 Jz  *rc (VPR4R#)z L{calcResponse} accepts the C{'md5-sess'} algorithm and returns an MD5 hash of its parameters, including the nonce count, client nonce, and QoP value if they are specified. rUN)rr$s&r test_MD5SessionHashResponseExtra0DigestAuthTests.test_MD5SessionHashResponseExtras &&{3rc 2VPR\4R#)z L{calcResponse} accepts the C{'sha'} algorithm and returns a SHA hash of its parameters, including the nonce count, client nonce, and QoP value if they are specified. rZN)rrr$s&rtest_SHAHashResponseExtra)DigestAuthTests.test_SHAHashResponseExtras &&vt4rc RV9dVPVR&RV9dVPVR&RV9dVPVR&RV9dVPVR&RV9dVPVR&RV9dVP VR&V'dRpMRpR P VP4UUu.uF)wrEVfK RP \V4R W5V34NK+ upp4#uuppi) a Format all given keyword arguments and their values suitably for use as the value of an HTTP header. @types quotes: C{bool} @param quotes: A flag indicating whether to quote the values of each field in the response. @param **kw: Keywords and C{bytes} values which will be treated as field name/value pairs to include in the result. @rtype: C{bytes} @return: The given fields formatted for use as an HTTP header value. r;r=r>r@r?rA"rs, =) r;r=r>r@r?rArIitemsr )rquoteskwquotekvs&&, rformatResponseDigestAuthTests.formatResponses R !]]BzN " **BwK b "nnB{O ?BuI 2 ;;BxL ?BuI EEzz!hhj (FQD-*D%EBC(    s 0C' ="C' c  VVPR4pVPR4P4pVPR4p\W@PVPVP W0P 4p\VRVPVR4p\WgWCW P V4pV#)z0 Calculate the response for the given challenge rNr>r@r:N) getlowerrr;r=r<r?r rAr ) r challengencountrNalgor@rVha2rQs &&& rgetDigestResponse!DigestAuthTests.getDigestResponses g&}}[)//1mmE" --T]]E;; dFDHHc48$v{{CPrc VPPVPP4pRpVP VVR,VP W#4VVR,R7pVPP W@PVPP4pVPVPVP44VPVPVPR,44R#)z L{DigestCredentialFactory.decode} accepts a digest challenge response and parses it into an L{IUsernameHashedPassword} provider. 00000001rNopaque)rrNrxncrwrongN rD getChallengerBhostrrdecoderC assertTrue checkPasswordr< assertFalse)rrrrclientResponsecredss&& r test_responseDigestAuthTests.test_response.s **778J8J8O8OP ,,G$++I:X& - &&-- KK););)@)@  ++DMM:; ,,T]]X-EFGrc (VPR4R#)z L{DigestCredentialFactory.decode} accepts a digest challenge response which does not quote the values of its fields and parses it into an L{IUsernameHashedPassword} provider in the same way it would a response which included quoted field values. FN)rr$s&rtest_responseWithoutQuotes*DigestAuthTests.test_responseWithoutQuotesCs 5!rc 6RVnVPR4R#)z L{DigestCredentialFactory.decode} accepts a digest challenge response which quotes the values of its fields and includes a C{b","} in the URI field. s /some,path/TN)rArr$s&rtest_responseWithCommaURI)DigestAuthTests.test_responseWithCommaURILs " 4 rc 4RVnVP4R#)z[ The case of the algorithm value in the response is ignored when checking the credentials. sMD5Nr>rr$s&rtest_caseInsensitiveAlgorithm-DigestAuthTests.test_caseInsensitiveAlgorithmUs   rc 4RVnVP4R#)zF The algorithm defaults to MD5 if it is not supplied in the response. Nrr$s&rtest_md5DefaultAlgorithm(DigestAuthTests.test_md5DefaultAlgorithm]s rc VPPR4pRpVPVR,VPW4VVR,R7pVPP W0P R4pVP VPVP44VPVPVPR,44R#)z{ L{DigestCredentialFactory.decode} accepts a digest challenge response even if the client address it is passed is L{None}. NrrNrrNrxrrr) rDrrrrrCrrr<rrrrrrs& rtest_responseWithoutClientIP,DigestAuthTests.test_responseWithoutClientIPds **77= ,,G$++I:X& -  &&--nkk4P ++DMM:; ,,T]]X-EFGrc VPPVPP4pRpVP VR,VP W4VVR,R7pVPP W0PVPP4pVPVPVP44VPVPVPR,44RpVP VR,VP W4VVR,R7pVPP W0PVPP4pVPVPVP44VPVPVPR,44R#)zU L{DigestCredentialFactory.decode} handles multiple responses to a single challenge. rrNrrrs00000002Nrrs& rtest_multiResponse"DigestAuthTests.test_multiResponsevst **778J8J8O8OP ,,G$++I:X& - &&-- KK););)@)@  ++DMM:; ,,T]]X-EFG ,,G$++I:X& - &&-- KK););)@)@  ++DMM:; ,,T]]X-EFGrc VPPVPP4pRpVP VR,VP W4VVR,R7pVPP VRVPP4pVPVPVP44VPVPVPR,44R#)z L{DigestCredentialFactory.decode} returns an L{IUsernameHashedPassword} provider which rejects a correct password for the given user if the challenge response request is made using a different HTTP method than was used to request the initial challenge. rrNrrsPOSTrN) rDrrBrrrrrrr<rs& rtest_failsWithDifferentMethod-DigestAuthTests.test_failsWithDifferentMethods**778J8J8O8OP ,,G$++I:X& -  &&-- GT%7%7%<%<  ,,T]];< ,,T]]X-EFGrc VP\VPPVP RR7VP VP P4pVP\V4R4VP\VPPVP RR7VP VP P4pVP\V4R4R#)z L{DigestCredentialFactory.decode} raises L{LoginFailed} if the response has no username field or if the username field is empty. N)r;z$Invalid response, no username given.r assertRaisesr rDrrrCrBrrKstrres& rtest_noUsernameDigestAuthTests.test_noUsernames      " " ) )     . KK    # #   Q!GH      " " ) )     - KK    # #   Q!GHrc VP\VPPVP RR7VP VP P4pVP\V4R4R#)zW L{DigestCredentialFactory.decode} raises L{LoginFailed} if the response has no nonce. rt)rz!Invalid response, no nonce given.Nrrs& r test_noNonceDigestAuthTests.test_noNoncesd      " " ) )   y  1 KK    # #   Q!DErc VP\VPPVP 4VP VP P4pVP\V4R4R#)zX L{DigestCredentialFactory.decode} raises L{LoginFailed} if the response has no opaque. z"Invalid response, no opaque given.Nrrs& r test_noOpaqueDigestAuthTests.test_noOpaques_      " " ) )    ! KK    # #   Q!EFrc VPPVPP4pRpVP VR,VP W4VVR,R7pVPP W0PVPP4pVP\\V44VPR,VP,R,VP,p\V4pVPVP\!VP#4444VP%R4VP'VP\!VP#4444R#)z L{DigestCredentialFactory.decode} returns an L{IUsernameDigestHash} provider which can verify a hash of the form 'username:realm:password'. rrNrrrHrN)rDrrBrrrrrCrrrr;r=r<r checkHashrrJupdater)rrrrr cleartexthashs& rtest_checkHashDigestAuthTests.test_checkHashs  **778J8J8O8OP ,,G$++I:X& - &&-- KK););)@)@   %8%@AMMD(4::5?@ H )?@Arc  \VPVP4pVPVPP 4pVP \VPRVR,VPP 4pVP\V4R4R\R4,pVP \VPVVR,VPP 4pVP\V4R4VP \VPRVR,VPP 4pVP\V4R4R\RPVR,\VPP 4R344,pVP \VPVVR,VPP 4pVP\V4R 4R #) zx L{DigestCredentialFactory.decode} raises L{LoginFailed} when the opaque value does not contain all the required parts. s badOpaquerNz&Invalid response, invalid opaque valuesfoo-snonce,clientipr,r6z,Invalid response, invalid opaque/time valuesN)rr>r=rrBrrr _verifyOpaquerKrrrIr )rrDrexc badOpaques& rtest_invalidOpaque"DigestAuthTests.test_invalidOpaques 8 S%2243E3E3J3JK    + +  g     # #   S#KLi(9::    + +  g     # #   S#KL   + +  g     # #   S#KLi II7#]43E3E3J3J%KYW      + +  g     # #   S#QRrc 2\VPVP4pVPVPP 4pVP RVPP 4pVP\VPVVR,VPP 4pVP\V4R4VP\VPVRVPP 4pVP\V4R4R#)z L{DigestCredentialFactory.decode} raises L{LoginFailed} when the given nonce from the response does not match the nonce encoded in the opaque. s 1234567890rNz2Invalid response, incompatible opaque/nonce valuesrN) rr>r=rrBr_generateOpaquerr rrKr)rrDrbadNonceOpaquers& rtest_incompatibleNonce&DigestAuthTests.test_incompatibleNonce1s 8 S%2243E3E3J3JK *:: 4--22    + +  g     # #   S#WX   + +      # #   S#WXrc \VPVP4pVPVPP 4pRpVP VPP V4VPVR,V4pVP\VPVVR,VPP 4R#)z L{DigestCredentialFactory.decode} raises L{LoginFailed} when the request comes from a client IP other than what is encoded in the opaque. z10.0.0.1rNN) rr>r=rrBrassertNotEqualrrr r)rrDr badAddressrs& rtest_incompatibleClientIP)DigestAuthTests.test_incompatibleClientIPOs 8 S%2243E3E3J3JK   D..33Z@*:: g       + +  g     # #  rc 8\VPVP4pVPVPP 4pRP VR,\VPP 4R34p\\W1P,4P44p\V4pRP WEPR434pVP\VP VVR,VPP 4R#)z L{DigestCredentialFactory.decode} raises L{LoginFailed} when the given opaque is older than C{DigestCredentialFactory.CHALLENGE_LIFETIME_SECS} rrNs -137876876- N)rr>r=rrBrrIr rrrrJrrrr r)rrDrkeyrJekeyoldNonceOpaques& r test_oldNonceDigestAuthTests.test_oldNoncehs 8 S%2243E3E3J3JK ii w t/A/A/F/F!G W S#?#??@GGIJ~FJJu,=#>?    + +  g     # #  rc \VPVP4pVPVPP 4pRP VR,\VPP 4R34p\\VR,4P44pRP V\V434pVP\VPVVR,VPP 4R#)zf L{DigestCredentialFactory.decode} raises L{LoginFailed} when the opaque checksum fails verification. rrNrsthis is not the right pkeyrN)rr>r=rrBrrIr rrrJrrr r)rrDrrrJ badChecksums& rtest_mismatchedOpaqueChecksum-DigestAuthTests.test_mismatchedOpaqueChecksums 8 S%2243E3E3J3JK ii w t/A/A/F/F!G N S#@@AHHJKii3 89     + +  g     # #  rc  fRpVF(wr#rEVP\\RVVVRRVR7 K* R#)z L{calcHA1} raises L{TypeError} when any of the pszUsername, pszRealm, or pszPassword arguments are specified with the preHA1 keyword argument. Nr7snoncescnonce)preHA1))suserrealmpasswordpreHA1)NrNr)NNrr)r TypeErrorr)r arguments pszUsernamepszRealm pszPasswordrs& rtest_incompatibleCalcHA1Options/DigestAuthTests.test_incompatibleCalcHA1OptionssJ  ;D 6K;     ;Drc bVPPRR4pVPRV4R#)zu L{DigestCredentialFactory._generateOpaque} returns a value without newlines, regardless of the length of the nonce. Nrsnlong nonce long nonce long nonce long nonce long nonce long nonce long nonce long nonce long nonce long nonce )rDr assertNotIn)rrs& rtest_noNewlineOpaque$DigestAuthTests.test_noNewlineOpaques- ''778KTR 'r) r>rBr?rDrCr<r@r=rAr;N)T)-r*r+r,r-r.rErrRrWr[rarerhrkrnrqryr|rrrrrrrrrrrrrrrrrrrrrrrrrr/r0)r2s@rr4r48s U)/c + +*-3# +06S +-0.1/5C+ /04:+B45& P H*"!H$!HFH,I2 F GB41SfY< 2 0 .2((rr4)r.rbinasciirhashlibrrzope.interface.verifyrtwisted.cred.credentialsrrrr r twisted.cred.errorr twisted.internet.addressr twisted.python.compatr twisted.trial.unittestrrrr4r#rrrsP .+0/+'"9.~ (h~ (r